Analysis
-
max time kernel
147s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-12-2024 23:51
General
-
Target
JaffaCakes118_172bbc387e453f3b5f9df871aaa0d49bddc8bb9218445db58342ee1741141c85.exe
-
Size
715.0MB
-
MD5
c1f41959bc165b2d2552c5b00396073d
-
SHA1
51438768ed8a9e0788c22e022841d8b99814d901
-
SHA256
172bbc387e453f3b5f9df871aaa0d49bddc8bb9218445db58342ee1741141c85
-
SHA512
88bf4ff35b34d9c0333f490f1a6035ab7a8be0eb3c08266946c9cfbe52fc9a788de055921177a95be149fb2b8d280fd8d0254476b8518b84316bc51a7a4934c7
-
SSDEEP
24576:MptWrkUP/1F51MfojHpez56/ODIi7kR60DckhX:K3UH7DKAIbki7y9hX
Malware Config
Extracted
redline
CRYPT BY META
89.107.10.226:37141
-
auth_value
31efbabdcfc797323e09a896b4808afe
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_172bbc387e453f3b5f9df871aaa0d49bddc8bb9218445db58342ee1741141c85.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_172bbc387e453f3b5f9df871aaa0d49bddc8bb9218445db58342ee1741141c85.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
7.7MB
-
Filesize
6.1MB
-
Filesize
7.7MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB